> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/cli/reference/commands/secrets.md).

# Secret commands

Every option of the devo secret, devo secretspec, and devo generate commands, with defaults, allowed values, and the rules Devolutions CLI checks.

This page lists every argument and option of the commands that read, inject, and write secrets (`devo secret`), connect SecretSpec (`devo secretspec`), and generate passwords and keys (`devo generate`). For an overview of all commands, see [Commands](/cli/reference/commands.md). For step-by-step help, see [Use secrets without exposing them](/cli/guides/secrets.md), [Run a command with its secrets](/cli/guides/secrets/run-with-secrets.md), [Use secrets in your current shell](/cli/guides/secrets/current-shell.md), [Fill a configuration file from a template](/cli/guides/secrets/fill-a-template.md), [Update a secret from a script](/cli/guides/secrets/update-a-secret.md), [Use Devolutions CLI with SecretSpec](/cli/guides/secrets/secretspec.md) and [Generate passwords and SSH keys](/cli/guides/generate.md).

The options every command accepts, such as `--context`, `--source`, or `--output json`, are in [Global options](/cli/reference/global-options.md). The syntax of `devo://` references is in [Secret reference syntax](/cli/reference/secret-references.md).

{% hint style="warning" %}
`devo secret read`, `devo secret get`, `devo secret inject`, and `devo secret shell enter` hand the value over to you: it appears in the terminal, in a file, or in your shell session. `devo secret run` is the only command that keeps it out of your terminal. See [What stays hidden, and what doesn't](/cli/guides/understand/security-model.md).
{% endhint %}

## devo secret run

Runs a command with references resolved into its environment only. Resolved values are replaced with `<concealed by Devolutions>` in what the command prints, unless you add `--no-masking`.

**Workspace:** All workspace types

```bash
devo secret run [--env-ref <NAME>=<reference>]... [--env-file <path>] [--stdin-reference <reference>] [--timeout-seconds <seconds>] -- <command> [<arguments>]
devo secret run --manifest <path>
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>-- &#x3C;command> [&#x3C;arguments>]</code></td><td></td><td>The command to run and its arguments, after <code>--</code>. Required, unless you use <code>--manifest</code>. An argument that is a reference is refused: pass references with <code>--env-ref</code>, <code>--stdin-reference</code>, <code>--env-file</code>, or <code>--manifest</code>. A reference inside a longer argument, such as <code>--password=devo://…</code>, isn't refused but isn't resolved either.</td></tr><tr><td><code>--env-ref &#x3C;NAME>=&#x3C;reference></code></td><td></td><td>Puts the value of a reference in the environment variable <code>NAME</code> of the command. Repeat for several variables. The name must use letters, digits, and underscores, and can't start with a digit. The value must be an exact <code>devo://</code> reference.</td></tr><tr><td><code>--env-file &#x3C;path></code></td><td></td><td>Environment file of <code>KEY=value</code> lines. Empty lines and lines that start with <code>#</code> are ignored; quotes around a value are removed. Values can be references. A line without <code>=</code> stops the command with exit code <code>2</code>. A variable of the file replaces a variable of your environment with the same name. See <a href="/cli/guides/secrets/replace-env-files.md">Take the passwords out of a .env file</a>.</td></tr><tr><td><code>--stdin-reference &#x3C;reference></code></td><td></td><td>Reference whose value is written, exactly, to the command's standard input. It must be an exact <code>devo://</code> reference; named and canonical references both work.</td></tr><tr><td><code>--manifest &#x3C;path></code></td><td></td><td>Launch manifest: a versioned JSON file that holds the command, its arguments, its references, and, optionally, a standard-input reference, a timeout, and a working folder (an absolute folder that exists). Can't be combined with <code>--env-ref</code>, <code>--env-file</code>, <code>--stdin-reference</code>, <code>--timeout-seconds</code>, or a command after <code>--</code>. With a manifest, variables of your environment that hold a reference aren't resolved.</td></tr><tr><td><code>--timeout-seconds &#x3C;seconds></code></td><td>None</td><td>Maximum run time of the command, greater than zero. When it's exceeded, the command is stopped and <code>devo</code> exits with code <code>124</code>. Without it, there's no time limit.</td></tr><tr><td><code>--receipt-file &#x3C;path></code></td><td></td><td>Writes a receipt of the launch after the command ends: a JSON file with the launch plan, the variable names, the exit code, and the duration, without any value. The file must not exist yet. If it does, the command still runs, but the receipt isn't written and <code>devo</code> exits with code <code>1</code> instead of the exit code of your command.</td></tr><tr><td><code>--check</code></td><td>Off</td><td>Checks that the command exists and that the references are well formed, without reading any secret or starting the command. On a local profile, and for a named reference, it also checks that the vault and the entry exist; on Devolutions Cloud and Devolutions Server, a canonical reference isn't looked up. Can't be combined with <code>--dry-run</code>.</td></tr><tr><td><code>--dry-run</code></td><td>Off</td><td>Checks the launch plan and shows it, without contacting your workspace, looking for the command, reading any secret, or starting the command. Can't be combined with <code>--check</code>.</td></tr><tr><td><code>--no-masking</code></td><td>Off</td><td>Stops replacing resolved values with <code>&#x3C;concealed by Devolutions></code> in what the command prints on its standard output and error output.</td></tr></tbody></table>

Besides `--env-ref` and `--env-file`, any variable of your environment whose value is a `devo://` reference is resolved for the command, unless you use `--manifest`. The same variable name can't come from two sources, for example an `--env-ref` and a variable of your environment: the command stops instead.

**Exit codes:** an invalid launch, such as a malformed `--env-ref` or both `--check` and `--dry-run`, exits with `2` before anything is read. A timeout exits with `124`, a cancellation with <kbd>Ctrl</kbd>+<kbd>C</kbd> with `130`. Otherwise, `devo secret run` exits with the exit code of your command. See [Exit codes and errors](/cli/reference/exit-codes-and-errors.md).

## devo secret read

Reads one reference and writes the value to the terminal or a file.

**Workspace:** All workspace types

```bash
devo secret read <reference> [--attribute <attribute>] [--out-file <path> [--force]] [--raw]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;reference></code></td><td></td><td>The reference to read, such as <code>devo://&#x3C;workspace>/&#x3C;vault>/&#x3C;entry>/password</code>. Required. A malformed reference is refused before anything is read. See <a href="/cli/reference/secret-references.md">Secret reference syntax</a>.</td></tr><tr><td><code>--attribute &#x3C;attribute></code> (<code>--attr</code>)</td><td></td><td>What to read about the field: <code>value</code>, <code>type</code>, <code>id</code>, <code>title</code>, or <code>purpose</code>, in any case. <code>otp</code> is accepted but returns nothing. Any other value is refused. Without this option, the reference's own <code>?attribute=</code> applies, or <code>value</code>. See <a href="/cli/reference/secret-references.md#attributes">Attributes</a>.</td></tr><tr><td><code>--out-file &#x3C;path></code> (<code>-f</code>)</td><td></td><td>Writes the value to a file instead of the terminal. The folder must exist and the path can't be a folder. With text output, nothing else is printed; with <code>--output json</code>, the result is printed without the value.</td></tr><tr><td><code>--force</code></td><td>Off</td><td>Overwrites the <code>--out-file</code> file if it exists. Without it, an existing file is refused.</td></tr><tr><td><code>--raw</code></td><td>Off</td><td>With text output, writes exactly the value to standard output, without a line break at the end. Without it, a line break follows the value.</td></tr></tbody></table>

## devo secret get

Reads one field of an entry of the selected workspace, by entry name or ID, without writing a reference.

**Workspace:** All workspace types

```bash
devo secret get <field> <entry> [--vault <vault>] [--attribute <attribute>] [--out-file <path> [--force]] [--raw]
devo secret get <field> id:<entry-id> --vault-id <vault-id>
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;field></code></td><td></td><td>The field to read, such as <code>password</code>, <code>username</code>, <code>domain</code>, <code>host</code>, <code>otp</code>, or <code>privatekey</code>. Required. Devolutions Server reads any data property of the entry.</td></tr><tr><td><code>&#x3C;entry></code></td><td></td><td>The entry name, or its ID with <code>id:&#x3C;value></code> or <code>--id</code>. Required.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;entry></code> as an ID.</td></tr><tr><td><code>--workspace &#x3C;workspace></code></td><td>Current workspace</td><td>Workspace of the entry, by name or ID.</td></tr><tr><td><code>--vault &#x3C;vault></code></td><td>Current vault</td><td>Vault of the entry, by name or ID.</td></tr><tr><td><code>--vault-id &#x3C;id></code></td><td></td><td>Vault of the entry, by ID. Takes priority over <code>--vault</code>. With an entry ID and no vault option, the current vault is used; if no vault is selected, the command asks for <code>--vault-id</code>.</td></tr><tr><td><code>--section &#x3C;section></code></td><td></td><td>Section of the field, when the field is in a section. Can't be combined with an entry ID or with the passphrase options.</td></tr><tr><td><code>--attribute &#x3C;attribute></code> (<code>--attr</code>)</td><td><code>value</code></td><td>What to read about the field: <code>value</code>, <code>type</code>, <code>id</code>, <code>title</code>, or <code>purpose</code>. <code>otp</code> is accepted but returns nothing. With a passphrase option, only <code>value</code> is accepted.</td></tr><tr><td><code>--passphrase-env &#x3C;variable></code></td><td></td><td>Local profile only: name of the environment variable that holds the passphrase of a protected workspace. Refused on Devolutions Cloud and Devolutions Server. Needs the entry ID (<code>id:&#x3C;value></code> or <code>--id</code>). With a passphrase option, only the <code>password</code> field can be read, only one of the two passphrase options can be given, only text output is accepted, and without <code>--vault-id</code> or <code>--vault</code> the default vault of the workspace is used.</td></tr><tr><td><code>--passphrase-file &#x3C;path></code></td><td></td><td>Local profile only: private file that holds the passphrase of a protected workspace. Same rules as <code>--passphrase-env</code>.</td></tr><tr><td><code>--out-file &#x3C;path></code> (<code>-f</code>)</td><td></td><td>Writes the value to a file instead of the terminal. Same rules as for <code>devo secret read</code>.</td></tr><tr><td><code>--force</code></td><td>Off</td><td>Overwrites the <code>--out-file</code> file if it exists.</td></tr><tr><td><code>--raw</code></td><td>Off</td><td>With text output, writes exactly the value to standard output, without a line break at the end.</td></tr></tbody></table>

## devo secret set

Writes one secret field of an entry, with the new value from an environment variable or a file. The new value is never printed.

**Workspace:** All workspace types. Devolutions Server writes any data property of the entry; Devolutions Cloud and local profiles write `password` only.

```bash
devo secret set <field> <entry> --value-env <variable> --yes
devo secret set <field> <entry> --value-file <path> --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;field></code></td><td></td><td>The field to write. Required. On Devolutions Cloud and a local profile, any field other than <code>password</code> is refused with an error that says the workspace accepts writes to the password field only.</td></tr><tr><td><code>&#x3C;entry></code></td><td></td><td>The entry name, or its ID with <code>id:&#x3C;value></code> or <code>--id</code>. Required.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;entry></code> as an ID.</td></tr><tr><td><code>--vault-id &#x3C;id></code></td><td></td><td>Vault of the entry, by ID. On a local profile, with an entry ID and no <code>--vault-id</code>, the default vault of the workspace is used. On Devolutions Cloud, without it, the current vault is used.</td></tr><tr><td><code>--value-env &#x3C;variable></code></td><td></td><td>Name of the environment variable that holds the new value. Use exactly one of <code>--value-env</code> or <code>--value-file</code>.</td></tr><tr><td><code>--value-file &#x3C;path></code></td><td></td><td>File that holds the new value.</td></tr><tr><td><code>--passphrase-env &#x3C;variable></code></td><td></td><td>Local profile only: name of the environment variable that holds the passphrase of a protected workspace. Refused on Devolutions Cloud and Devolutions Server.</td></tr><tr><td><code>--passphrase-file &#x3C;path></code></td><td><code>&#x3C;workspace file>.passphrase</code></td><td>Local profile only: private file that holds the passphrase of a protected workspace. Without either passphrase option, the file <code>&#x3C;workspace file>.passphrase</code> in the profile folder is used. Refused on Devolutions Cloud and Devolutions Server.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the change. Required: without it, nothing is written.</td></tr></tbody></table>

## devo secret inject

Replaces the references in a text, from standard input or a file, with their values.

**Workspace:** All workspace types

```bash
devo secret inject [--in-file <path>] [--out-file <path> [--force]]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--in-file &#x3C;path></code> (<code>-i</code>)</td><td>Standard input</td><td>Template to read.</td></tr><tr><td><code>--out-file &#x3C;path></code> (<code>-f</code>)</td><td>Standard output</td><td>File to write. The folder must exist and the path can't be a folder.</td></tr><tr><td><code>--force</code></td><td>Off</td><td>Overwrites the <code>--out-file</code> file if it exists. Without it, an existing file is refused.</td></tr></tbody></table>

If any reference in the template can't be resolved, nothing is written and the command exits with code `1`. With `--output json` or `--output yaml`, the command prints a summary instead of the filled text: use `--out-file` to get the text. See [Fill a configuration file from a template](/cli/guides/secrets/fill-a-template.md).

## devo secret shell enter

Prints shell code that loads references into your current Bash or PowerShell session. Run that code with `eval` (Bash) or `Invoke-Expression` (PowerShell). See [Use secrets in your current shell](/cli/guides/secrets/current-shell.md).

**Workspace:** All workspace types

```bash
devo secret shell enter --shell <bash|pwsh> --env-ref <NAME>=<reference> [--env-ref ...] [--check --output json]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--shell &#x3C;shell></code></td><td></td><td>Shell to write code for: <code>bash</code>, or <code>pwsh</code> (<code>powershell</code> works the same). Required. Any other value is refused.</td></tr><tr><td><code>--env-ref &#x3C;NAME>=&#x3C;reference></code></td><td></td><td>Variable to load and its reference. Repeat for several variables. At least one is required. Each name must be unique, without regard to case. The command doesn't read your environment or <code>.env</code> files.</td></tr><tr><td><code>--check</code></td><td>Off</td><td>Checks the references, as <code>devo secret run --check</code> does, without reading any secret or writing shell code. Needs <code>--output json</code>.</td></tr></tbody></table>

Without `--check`, the command needs text output, so the shell can run what it prints. If a reference can't be read, nothing is printed on standard output and the command exits with a non-zero code.

## devo secret shell leave

Prints shell code that undoes the most recent `devo secret shell enter`, restoring each variable as it was before.

**Workspace:** All workspace types

```bash
devo secret shell leave --shell <bash|pwsh>
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--shell &#x3C;shell></code></td><td></td><td>Shell to write code for: <code>bash</code> or <code>pwsh</code> (<code>powershell</code> works the same). Required. Use the same value as for <code>enter</code>. The command needs text output.</td></tr></tbody></table>

## devo secret shell status

Shows whether a scope from `devo secret shell enter` is active in the current shell, how many scopes are nested, and the names of the variables set by the most recent one. It never shows values.

**Workspace:** All workspace types

```bash
devo secret shell status --shell <bash|pwsh> --output json
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--shell &#x3C;shell></code></td><td></td><td>Shell to inspect: <code>bash</code> or <code>pwsh</code> (<code>powershell</code> works the same). Required. The command needs <code>--output json</code>.</td></tr></tbody></table>

## devo secret catalog entry

Lists the `devo://` references of an entry's fields, ready to copy, without any value. Same as `devo entry references`. See [Find the reference to a secret](/cli/guides/secrets/find-a-reference.md).

**Workspace:** All workspace types

```bash
devo secret catalog entry <entry> [--vault-name <vault> | --vault-id <id>]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;entry></code></td><td></td><td>The entry name, or its ID with <code>id:&#x3C;value></code> or <code>--id</code>. Required.</td></tr><tr><td><code>--id</code></td><td>Off</td><td>Treats <code>&#x3C;entry></code> as an ID.</td></tr><tr><td><code>--vault-id &#x3C;id></code></td><td></td><td>Vault of the entry, by ID. On Devolutions Cloud, without a vault option, the current vault is used.</td></tr><tr><td><code>--vault-name &#x3C;name></code></td><td></td><td>Vault of the entry, by name.</td></tr></tbody></table>

## devo secret capabilities

Describes, for Devolutions Cloud, Devolutions Server, and local profiles, what the secret commands support, such as which fields can be read and written. No value is returned, and no workspace is contacted.

**Workspace:** All workspace types

```bash
devo secret capabilities --output json
```

This command has no arguments or options of its own.

## devo secretspec register

Registers this `devo` as the SecretSpec provider for `devo://` provider URIs, by writing a `devo.secretspec.json` claim file. See [Use Devolutions CLI with SecretSpec](/cli/guides/secrets/secretspec.md#where-the-claim-file-goes) for where the file goes.

**Workspace:** All workspace types

```bash
devo secretspec register [--system] [--executable <path>] [--environment <name>]... [--force] [--dry-run]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--system</code></td><td>Off</td><td>Writes the claim for every user of the computer instead of only for you. This usually needs administrator rights.</td></tr><tr><td><code>--executable &#x3C;path></code></td><td>This <code>devo</code></td><td>The <code>devo</code> executable to register. The path must be absolute and the file must exist. A path to the <code>dotnet</code> host is refused: register the published <code>devo</code> executable.</td></tr><tr><td><code>--environment &#x3C;name></code> (<code>--env</code>)</td><td></td><td>Extra environment variable SecretSpec may pass to <code>devo</code>, by exact name or by prefix ending in <code>*</code>, such as <code>DEVO_*</code>. Repeat for several. A name uses letters, digits, and underscores and can't start with a digit; anything else is refused. <code>RDM_CONFIG_PATH</code> and <code>DEVO_CLI_CONFIG_HOME</code> are always included.</td></tr><tr><td><code>--force</code></td><td>Off</td><td>Replaces an existing claim that registers an executable that isn't a <code>devo</code> executable. A claim that points at another <code>devo</code> executable is replaced without <code>--force</code>.</td></tr><tr><td><code>--dry-run</code></td><td>Off</td><td>Shows the claim that would be written, without writing it.</td></tr></tbody></table>

If the same claim is already in place, nothing is written and the command reports it as unchanged.

## devo secretspec unregister

Removes the `devo.secretspec.json` claim, so SecretSpec no longer starts Devolutions CLI. If there's no claim, the command reports it as absent.

**Workspace:** All workspace types

```bash
devo secretspec unregister [--system] [--dry-run]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--system</code></td><td>Off</td><td>Removes the claim for every user of the computer instead of yours.</td></tr><tr><td><code>--dry-run</code></td><td>Off</td><td>Shows the claim that would be removed, without removing it.</td></tr></tbody></table>

## devo secretspec status

Shows the claim for your user and the claim for the computer, and for each one whether it points at the `devo` you're running.

**Workspace:** All workspace types

```bash
devo secretspec status
```

This command has no arguments or options of its own.

## devo secretspec uri

Prints the provider URI to put in `secretspec.toml` for the selected workspace: the one given with `--source` or `--context`, or the current context.

**Workspace:** All workspace types

```bash
devo secretspec uri --context <context-name> [--vault-id <vault-id>]
devo secretspec uri --source sqlite --workspace-id sqlite:<file-name>.db [--vault-id <vault-id>]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--vault-id &#x3C;id></code></td><td></td><td>Default vault for the provider. A secret can still name its own vault. Without it, every secret must name its vault.</td></tr><tr><td><code>--workspace-id &#x3C;id></code></td><td></td><td>Local profile only, and required there: the workspace ID, written <code>sqlite:&#x3C;file-name>.db</code>, such as <code>sqlite:Connections.db</code>. <code>devo workspace current</code> shows it. Refused for Devolutions Cloud and Devolutions Server, whose URIs select a context instead.</td></tr></tbody></table>

## devo secretspec provider

Serves the SecretSpec provider protocol over standard input and output. SecretSpec starts it on its own through the registered claim; you don't run it yourself.

**Workspace:** All workspace types

```bash
devo secretspec provider
```

This command has no arguments or options of its own.

## devo generate password

Generates a strong random password on your computer. It always contains at least one lowercase letter, one uppercase letter, one digit, and one symbol from `!@#$%^&*?`. Like every `devo generate` command, it doesn't contact any workspace or start the background process.

**Workspace:** All workspace types (works on your computer only)

```bash
devo generate password [--length <length>]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--length &#x3C;length></code></td><td><code>32</code></td><td>Length of the password, from 8 to 4096. <code>0</code> or a negative value means the default, 32. Any other value outside the range is refused.</td></tr></tbody></table>

## devo generate human-readable

Generates a password that's easy to read: pronounceable lowercase syllables, then digits, then symbols.

**Workspace:** All workspace types (works on your computer only)

```bash
devo generate human-readable [--syllables <count>] [--numerics <count>] [--symbols <count>]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--syllables &#x3C;count></code></td><td><code>4</code></td><td>Number of syllables, each one a consonant and a vowel, from 1 to 64.</td></tr><tr><td><code>--numerics &#x3C;count></code></td><td><code>1</code></td><td>Number of digits added after the syllables, from 0 to 64.</td></tr><tr><td><code>--symbols &#x3C;count></code></td><td><code>1</code></td><td>Number of symbols from <code>!@#$%^&#x26;*?</code> added at the end, from 0 to 64.</td></tr></tbody></table>

## devo generate passphrase

Generates a passphrase made of random words from a dictionary.

**Workspace:** All workspace types (works on your computer only)

```bash
devo generate passphrase [--words <count>] [--separator <text>] [--dictionary <dictionary>]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--words &#x3C;count></code></td><td><code>5</code></td><td>Number of words, from 1 to 64.</td></tr><tr><td><code>--separator &#x3C;text></code></td><td><code>-</code></td><td>Text placed between the words. An empty value means the default, <code>-</code>.</td></tr><tr><td><code>--dictionary &#x3C;dictionary></code></td><td><code>English</code></td><td>Word list: <code>English</code> (or <code>en</code>), <code>French</code> (or <code>fr</code>), or <code>German</code> (or <code>de</code>), in any case. Any other value is refused.</td></tr></tbody></table>

## devo generate pattern

Generates a password from a pattern, one character per letter of the pattern.

**Workspace:** All workspace types (works on your computer only)

```bash
devo generate pattern <pattern> [--shuffle]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>&#x3C;pattern></code></td><td></td><td>The pattern. Required, up to 4096 letters. Each letter gives one character: <code>u</code> uppercase letter, <code>l</code> lowercase letter, <code>d</code> digit, <code>s</code> symbol from <code>!@#$%^&#x26;*?</code>, <code>x</code> any of these. Letters are accepted in any case; any other character is refused. For example, <code>uulldds</code>.</td></tr><tr><td><code>--shuffle</code></td><td>Off</td><td>Mixes the generated characters, so their order no longer follows the pattern.</td></tr></tbody></table>

## devo generate ssh-key

Generates an RSA key pair on your computer: a private key in PEM format, encrypted when you give a passphrase, and a public key in OpenSSH format. The public key is also printed.

**Workspace:** All workspace types (works on your computer only)

```bash
devo generate ssh-key --out-file <path> [--bits <bits>] [--comment <text>] [--passphrase-env <variable> | --passphrase-file <path>] [--public-out-file <path>] [--force]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--out-file &#x3C;path></code></td><td></td><td>Private key file. Required. The folder must exist. On macOS and Linux, only your user account can read the file.</td></tr><tr><td><code>--public-out-file &#x3C;path></code></td><td><code>&#x3C;out-file>.pub</code></td><td>Public key file. It must be different from <code>--out-file</code>.</td></tr><tr><td><code>--algorithm &#x3C;algorithm></code></td><td><code>rsa</code></td><td>Key algorithm. <code>rsa</code> is the only supported value.</td></tr><tr><td><code>--bits &#x3C;bits></code></td><td><code>3072</code></td><td>RSA key size: <code>2048</code>, <code>3072</code>, or <code>4096</code>. Any other value is refused.</td></tr><tr><td><code>--comment &#x3C;text></code></td><td>Your user name</td><td>Comment at the end of the public key. It can't contain control characters.</td></tr><tr><td><code>--passphrase-env &#x3C;variable></code></td><td></td><td>Name of the environment variable that holds the passphrase that protects the private key. The variable must be set and not empty. Use this option or <code>--passphrase-file</code>, not both. Without either one, the private key isn't encrypted.</td></tr><tr><td><code>--passphrase-file &#x3C;path></code></td><td></td><td>File that holds the passphrase. The file must exist and not be empty; line breaks at its end are ignored.</td></tr><tr><td><code>--force</code></td><td>Off</td><td>Overwrites the key files if they exist. Without it, an existing file is refused.</td></tr></tbody></table>

## Next

* [Sign-in and context commands](/cli/reference/commands/sign-in-and-contexts.md)
* [MCP, background process, and configuration commands](/cli/reference/commands/mcp-daemon-config.md)
* [Secret reference syntax](/cli/reference/secret-references.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/cli/reference/commands/secrets.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.